Post-quantum cryptography (PQC) is, and should be, currently dominating the field of cybersecurity, with many works designing and evaluating the transition of communications security to quantum-safe solutions. As the security level and implementations of post-quantum algorithms become more mature, the research on their application to realistic conditions changes accordingly, especially their application to widely adopted network architectures and corresponding protocols such as the Public Key Infrastructure (PKI). In this survey, we identified articles presenting ways of integrating PQC algorithms to PKI and classified related work according to the employed methods and benchmarking choices. The main results from many evaluations converge to similar conclusions on the performance of the most popular PC digital signature algorithms; however, modeling choices concerning architecture variants, hardware and measurement metrics vary. The diversity of the results and experimental setups makes comparison difficult and arrival at an objective conclusion regarding PKI requirements almost impossible. Ultimately, this review reveals a fragmented landscape of benchmarking practices for post-quantum PKI systems. The absence of standardized evaluation frameworks and common test environments limits the comparability and reproducibility of the findings. We aim to provide reference implementations, which are essential to guide the transition of PKI infrastructures toward robust, scalable, and quantum-resistant deployments.
Post-quantum cryptography (PQC) is, and should be, currently dominating the field of cybersecurity, with many works designing and evaluating the transition of communications security to quantum-safe solutions. As the security level and implementations of post-quantum algorithms become more mature, the research on their application to realistic conditions changes accordingly, especially their application to widely adopted network architectures and corresponding protocols such as the Public Key Infrastructure (PKI). In this survey, we identified articles presenting ways of integrating PQC algorithms to PKI and classified related work according to the employed methods and benchmarking choices. The main results from many evaluations converge to similar conclusions on the performance of the most popular PC digital signature algorithms; however, modeling choices concerning architecture variants, hardware and measurement metrics vary. The diversity of the results and experimental setups makes comparison difficult and arrival at an objective conclusion regarding PKI requirements almost impossible. Ultimately, this review reveals a fragmented landscape of benchmarking practices for post-quantum PKI systems. The absence of standardized evaluation frameworks and common test environments limits the comparability and reproducibility of the findings. We aim to provide reference implementations, which are essential to guide the transition of PKI infrastructures toward robust, scalable, and quantum-resistant deployments.
Development of Quantum Computers are growing rapidly, the security of today’s cryptographic systems which are working with Public Key Infrastructure (PKI) is at serious risk. RSA and ECC algorithms are the backbone of secure communication and digital identity can be breakable by quantum algorithms such as Shor’s. Hence, a transition is required to Post-Quantum Cryptography (PQC), which is designed to handle quantum attacks. This work provides a detailed review of how PQC can be integrated with the existing PKI, with a special focus on the auto-enrollment process. Auto-enrollment is an essential process but often overlooked mechanism, responsible for automatically issuing and renewing digital certificates. First, we explored how current PKI systems are exposed to the quantum threats and the readiness. The performance of the algorithms that are standardized by NIST, such as Kyber and Dilithium were discussed. We analyze the technical and operational challenges of transitioning to PQC by referencing both research studies and real-world implementations from major industry players such as Google and Microsoft. These include large key size, certificate size, compatibility issues, complex computations and need for crypto-agility. We also examine the hybrid approaches that combine classical and post-quantum methods as traditional strategies. The survey concludes by outlining best practices, deployment considerations, and open research challenges that must be addressed for a smooth, secure, and scalable shift to quantum-safe PKI. This work aims to guide researchers, engineers, and policymakers in building the next generation of cryptographic infrastructure that can stand the test-time even in a quantum world.
Advances in quantum computing pose a significant threat to the widely used Public Key Infrastructure (PKI). The two leading technologies to address this challenge are Post-Quantum Cryptography and Quantum Key Distribution. A promising approach is the hybridization of these technologies - combining their respective strengths while mitigating their limitations - and integrating them with the cryptographic mechanisms used today to enhance crypto-agility and facilitate transitioning to a quantum-safe infrastructure. However, changing current network protocols to quantum-safe alternatives is not just a matter of security: their efficiency and scalability must also be demonstrated within real-world telecommunications infrastructures to ensure their practical adoption. In this work, we present the first long-running test with detailed measurements of a suite of hybrid quantum-safe protocols that integrate classical cryptography, PQC, and QKD within a production environment (MadQCI). Using standardized protocols and interfaces and employing Transport Layer Security (TLS) as the base protocol for real-world comparison, this study demonstrates the efficiency and scalability of the proposed solution in deployed heterogeneous networks. These results mark a significant step towards the widespread adoption of quantum-safe hybrid protocols and contribute to clarifying the path toward their future standardization in next-generation telecommunications networks.
Large-scale quantum computers threaten the public-key cryptographic foundations underpinning today's network security infrastructures. While significant progress has been made in standardizing post-quantum cryptographic (PQC) primitives and adapting individual protocols such as TLS and SSH, far less attention has been paid to the broader architectural consequences of the post-quantum transition for networked systems. In particular, many real-world deployments such as mobile networks, industrial control systems, IoT environments, and regulated infrastructures cannot assume the universal availability, deployability, or desirability of PQ public-key infrastructures. This paper presents the first comprehensive systematization of PQ-resistant network architectures, focusing on key distribution and management as a system-level design problem rather than a protocol-local substitution. We introduce a unified taxonomy spanning cryptographic foundations (symmetric-only, PQ-PKI, hybrid, and information-theoretic multi-path), key-distribution architectures (centralized, hierarchical, replicated, threshold, MPC-backed, and serverless), trust and threat models, key-management lifecycle, and deployment environments. Using this framework, we analyze the security, scalability, and operational trade-offs of a wide range of architectures under realistic PQ adversary assumptions, including harvest-now, decrypt-later attacks and partial infrastructure compromise. Our study highlights fundamental gaps in existing approaches, clarifies when PQ-PKI is necessary or avoidable, and identifies promising research directions for building cryptographically agile, quantum-resilient network infrastructures.
Recently, there has been an increasing focus on the investigation of quantum-safe solutions for a variety of applications. One of the pressing issues that needs to be made quantum secure is the TLS (Transport Layer Security) protocol. Proposals for its implementation have been discussed in several articles. The TLS protocol is based on PKI (Public Key Infrastructure). In addition, there are many other PKI applications that are used every day in both private and enterprise environments, so securing their use is essential. The methods currently developed to ensure adequate security will become obsolete with the advent of quantum computers. According to the Cloud Security Alliance, by around 2030, the performance of quantum computers will increase to the point where the risk of vulnerability of traditionally encrypted data will be very high. It is therefore important to make the right preparations in time to ensure that we can transform our solutions into quantum secure solutions by the time quantum computing becomes a real threat. In this paper, we present an analysis to this end, presenting quantum-safe solutions already in use and, in comparison, proposing new, well-performing solutions for a quantum-resistant PKI.
Abstract Advances in quantum computing pose a significant threat to the widely used Public Key Infrastructure (PKI). The two leading technologies to address this challenge are Post-Quantum Cryptography and Quantum Key Distribution. A promising approach is the hybridization of these technologies - combining their respective strengths while mitigating their limitations - and integrating them with the cryptographic mechanisms used today to enhance crypto-agility and facilitate transitioning to a quantum-safe infrastructure. However, changing current network protocols to quantum-safe alternatives is not just a matter of security: their efficiency and scalability must also be demonstrated within real-world telecommunications infrastructures to ensure their practical adoption. In this work, we present the first long-running test with detailed measurements of a suite of hybrid quantum-safe protocols that integrate classical cryptography, PQC, and QKD within a production environment (MadQCI). Using standardized protocols and interfaces and employing Transport Layer Security (TLS) as the base protocol for real-world comparison, this study demonstrates the efficiency and scalability of the proposed solution in deployed heterogeneous networks. These results mark a significant step towards the widespread adoption of quantum-safe hybrid protocols and contribute to clarifying the path toward their future standardization in next-generation telecommunications networks.
Public Key Infrastructure (PKI) generates and distributes digital certificates to provide the root of trust for securing digital networking systems. To continue securing digital networking in the quantum era, PKI should transition to use quantum-resistant cryptographic algorithms. The cryptography community is developing quantum-resistant primitives/algorithms, studying, and analyzing them for cryptanalysis and improvements. National Institute of Standards and Technology (NIST) selected finalist algorithms for the post-quantum digital signature cipher standardization, which are Dilithium, Falcon, and Rainbow. We study and analyze the feasibility and the processing performance of these algorithms in memory/size and time/speed when used for PKI, including the key generation from the PKI end entities (e.g., a HTTPS/TLS server), the signing, and the certificate generation by the certificate authority within the PKI. The transition to post-quantum from the classical ciphers incur changes in the parameters in the PKI, for example, Rainbow I significantly increases the certificate size by 163 times when compared with RSA 3072. Nevertheless, we learn that the current X.509 supports the NIST post-quantum digital signature ciphers and that the ciphers can be modularly adapted for PKI. According to our empirical implementations-based study, the post-quantum ciphers can increase the certificate verification time cost compared to the current classical cipher and therefore the verification overheads require careful considerations when using the post-quantum-cipher-based certificates.